Title

The RUCKUS ICX BGP router must be configured to reject inbound route advertisements for any Bogon prefixes. (Cat II impact)

Discussion

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

Check Content

Verify a prefix list exists in the config: SSH@ICX(config)# show ip prefix-lists ip prefix-list PREFIX-FLTR: 1 entries seq 5 deny 0.0.0.0/8 le 32 seq 10 deny 10.0.0.0/8 le 32 ... seq 999 permit 0.0.0.0/0 le 8 Confirm that prefix list is applied to BGP: router bgp neighbor x.x.x.x prefix-list PREFIX-FLTR in If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Fix Text

Configure eBGP routers to reject inbound route advertisements for any Bogon prefixes. 1. Create the desired prefix list. SSH@ICX(config)# ip prefix PREFIX-FLTR seq 5 deny 0.0.0.0/8 le 32 SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 10 deny 10.0.0.0/8 le 32 ... SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 999 permit 0.0.0.0/0 le 8 2. Apply to applicable BGP neighbors. router bgp neighbor x.x.x.x prefix-list PREFIX-FLTR in

Additional Identifiers

Rule ID: SV-273570r1110906_rule

Vulnerability ID: V-273570

Group Title: SRG-NET-000018-RTR-000002

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.